Vulnerabilities in pkg:npm/@openclaw/voice-call

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mfg5-7q5g-f37j",
  "modified" : "2026-06-08T23:23:30Z",
  "published" : "2026-03-02T22:39:43Z",
  "aliases" : [ "CVE-2026-32062" ],
  "summary" : "OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure",
  "details" : "### Summary\n`@openclaw/voice-call` (and the bundled copy shipped in `openclaw`) accepted media-stream WebSocket upgrades before stream validation. In reachable deployments, unauthenticated pre-start sockets could be held open and increase resource pressure.\n\n### Affected Packages / Versions\n- `openclaw` (npm): vulnerable `<= 2026.2.21-2`, patched in `2026.2.22`.\n- `@openclaw/voice-call` (npm): vulnerable `<= 2026.2.21`, patched in `2026.2.22`.\n\n### Technical Details\nBefore this fix, the voice-call media-stream path upgraded sockets first and ran `shouldAcceptStream()` after a later `start` frame. This created a pre-auth window where remote clients could hold idle sockets without call/token validation.\n\n### Impact\nAvailability risk in deployments where the media-stream endpoint is reachable and streaming is enabled. Under sustained abuse, this could consume connection-related resources and degrade service for legitimate streams.\n\n### Remediation\nThe fix adds layered controls in the media-stream path:\n- strict pre-start timeout (close sockets that do not send a valid `start` frame quickly)\n- global pending-connection cap\n- per-IP pending-connection cap\n- total open media-stream connection cap\n- safer upgrade-path parsing in the webhook server\n\n### Fix Commit(s)\n- `1d8968c8a821ff1a05c294a1846b3bcb6f343794`\n\n### Release Process Note\n`patched_versions` is pre-set to `2026.2.22` so this advisory is ready to publish once npm `openclaw@2026.2.22` and `@openclaw/voice-call@2026.2.22` are released.\n\nOpenClaw thanks @jiseoung for reporting.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "openclaw"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2026.2.22"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@openclaw/voice-call"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2026.2.22"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/openclaw/openclaw/security/advisories/GHSA-mfg5-7q5g-f37j"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-32062"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openclaw/openclaw/commit/1d8968c8a821ff1a05c294a1846b3bcb6f343794"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/openclaw/openclaw"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/openclaw-unauthenticated-websocket-resource-exhaustion-via-media-stream"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400", "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-02T22:39:43Z",
    "nvd_published_at" : "2026-03-11T14:16:28Z"
  }
}